Data processing agreement (contrato de encargo)

Version 0.1.0 (draft). Last updated October 14, 2026.

This agreement is made between the employer of household workers who accepts it electronically in Casa al Día, personally or through a representative (the "Controller", Responsable), and Third Space Ventures LLC, which operates Casa al Día (the "Processor", Encargado), on the following recitals and clauses. It is an English translation; the Spanish text governs.

Recitals

I. The Controller states that:

• a) it employs, or is about to employ, one or more household workers and uses Casa al Día to manage that employment;
• b) it is the controller of those household workers' personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (the "Law");
• c) it obtains that data lawfully and has a legal basis to process it, in particular to meet its obligations under the employment relationship and the labor and social-security laws;
• d) if it accepts this agreement through a representative, such as a property manager, that representative has its authorization.

II. The Processor states that:

• a) it is a limited liability company organized under the laws of the State of Wyoming, United States of America, of 447 Broadway FL 2 STE 3065, New York, NY 10013, USA;
• b) it operates Casa al Día and maintains the security measures described in Annex B.

1. Definitions

Terms in this agreement have the meaning the Law gives them. In addition:

• a) Processed Data: the personal data of the Controller's household workers, of the beneficiaries they name, and of any other individual the Controller enters or uploads to Casa al Día in connection with that employment, as described in Annex A;
• b) Household: the Casa al Día account in which the Controller registers its household workers;
• c) Service: the Casa al Día app and the "Done for you" and "Concierge" services, as described in the Terms of service;
• d) Sub-processor: a provider the Processor engages that processes Processed Data.

2. Purpose

The Processor will process Processed Data only on the Controller's behalf and to provide the Service, with the scope, purposes and duration described in Annex A. The Processor acquires no title to or ownership of the Processed Data.

3. The Controller's instructions

3.1 The Controller's instructions are:

• a) what the Controller, or people the Controller gives access to its Household, enter, configure, generate, send or delete in the Service;
• b) the signed authorization the Controller uploads for "Done for you" and, where applicable, for "Concierge";
• c) further instructions the Controller sends in writing to hola@casa-al-dia.com that the Processor accepts as compatible with the Service.

3.2 If the Processor believes an instruction breaks the Law, it will tell the Controller and may decline to follow it.

3.3 The Controller can limit the processing at any time in the Service: turn off sending by WhatsApp or email, delete documents, remove access for people it invited, and cancel "Done for you" and "Concierge".

4. The Processor's obligations

4.1 The Processor will:

• a) process Processed Data only on the Controller's instructions;
• b) not process it for any other purpose, nor for its own purposes;
• c) apply the administrative, technical and physical security measures in Annex B, which will be no weaker than those it applies to its own information;
• d) keep Processed Data confidential and make sure everyone involved in processing it is bound to confidentiality, including after their relationship with the Processor ends;
• e) not transfer it, unless the Controller instructs it, the communication is to a Sub-processor authorized under clause 7, or a competent authority requires it;
• f) delete it when this agreement ends or when the Controller instructs, under clause 14;
• g) help the Controller deal with ARCO requests and security breaches, under clauses 9 and 10.

4.2 The Processor may produce aggregate statistics about use of the Service (for example, how many pay stubs were generated in a month) that neither contain nor allow anyone to derive data about any individual.

5. The Controller's obligations

The Controller will:

• a) give its household workers a privacy notice explaining, among other things, that their data is processed through Casa al Día and stored in the United States and, for WhatsApp, in other countries. The personal-data clause in the employment contract the Service produces can serve that purpose;
• b) obtain its household workers' consent where the Law requires it;
• c) confirm in the Service that each household worker agreed to receive their documents on WhatsApp before turning that channel on, and turn it off if the worker withdraws;
• d) enter accurate, current data and not enter sensitive personal data, which the Service doesn't need;
• e) inform named beneficiaries, where appropriate, about the processing of their data;
• f) answer its household workers' ARCO requests within the Law's deadlines.

6. Security measures

The Processor will maintain at least the measures in Annex B and update them according to the risk, the sensitivity of the data and technological developments. It may replace them with equivalent or better measures.

7. Sub-processors

7.1 The Controller authorizes the Processor to engage, in the Controller's name and on its behalf, the Sub-processors in Annex C and those added under clause 7.2. The Processor will put in place contractual terms with each one under which it assumes the obligations the Law and its Regulations place on a processor, and is answerable to the Controller for their compliance.

7.2 The Processor will tell the Controller, by email and in the Service, at least 30 calendar days in advance, of any new Sub-processor, and won't use it before then. If the Controller doesn't object within that period, the new Sub-processor is authorized. If the Controller objects for a reasonable data-protection reason, it may end this agreement and its subscription, with a prorated refund for the unused period.

8. International remisiones (communications to processors)

The Controller acknowledges and accepts that the Processor and the Sub-processors store and process Processed Data in the United States and, for Meta, in other countries too, and that the Processor's email service is provided by Fastmail Pty Ltd, an Australian company subject to Australian law, which stores email on servers in the United States and may process it in other countries where reasonably necessary for its service, as set out in Annex C. Passing data to processors does not need to be disclosed to, or consented to by, the individuals concerned; even so, the employment contract the Service produces discloses it.

9. ARCO rights

9.1 The Service lets the Controller view, correct and download Processed Data. To delete a household worker's data, the Controller can do so in the Service or ask at hola@casa-al-dia.com, and the Processor will do it within 5 business days.

9.2 If an individual sends the Processor an ARCO request about Processed Data, the Processor will pass it to the Controller within 2 business days, tell the individual it has passed the request to the Controller, and not answer it itself unless the Controller instructs it to.

9.3 The Processor will give the Controller reasonable information and help so it can answer within the deadlines in article 31 of the Law.

10. Security breaches

10.1 If the Processor becomes aware of a possible security breach affecting Processed Data, it will notify the Controller without delay and in any case within 24 hours, by email and in the Service, and will update the Controller as facts are confirmed.

10.2 The notice will state, as far as known: the nature of the incident and when it happened; the personal data compromised and the people who may be affected; the corrective actions the Processor took immediately; recommendations for affected people to protect their interests; and where to get more information. With that information, the Controller can give individuals the notice the law requires.

10.3 The Controller must inform individuals immediately when the breach significantly affects their patrimonial or moral rights. If the Controller asks, the Processor will draft the notice and may send it in the Controller's name by email or, to household workers who agreed to WhatsApp messages, by WhatsApp when an approved template exists for it.

10.4 The Processor will analyze the causes of the breach, take the corrective, preventive and improvement actions needed to stop it happening again, and report them to the Controller.

11. Access by the Processor's staff

The Processor's staff access a Household's Processed Data only when needed to provide "Done for you" or "Concierge", or for support the Controller asks for. They do so through internal tools that check the person is on the Processor's team and log who viewed which data, and when, and they are bound to confidentiality.

12. IMSS procedures

12.1 When the Controller buys "Done for you" or "Concierge", the Processor submits to IMSS, in the Controller's name and on its behalf, under its signed authorization, the data needed to register the household worker or generate payment slips. That communication is made by the Controller, through the Processor, to meet the Controller's social-security obligations.

12.2 The Processor never asks for or stores the Controller's SAT passwords, CIEC or e.firma files.

13. Requests from authorities

If an authority requires Processed Data from the Processor, the Processor will tell the Controller before handing it over, unless the law or the authority forbids it, and will hand over only what is strictly required.

14. Return and deletion

14.1 While the Household is active, including the read-only period in section 19.3 of the Terms of service, the Controller can download Processed Data and generated documents at any time.

14.2 When the Household closes, the Controller has 30 calendar days to download them. The Processor then deletes them within the following 60 calendar days, and backups are erased in their normal 7-calendar-day cycle. If the Controller asks, the Processor will confirm deletion in writing.

14.3 The Processor keeps Processed Data beyond those periods only where a legal provision requires it, and only for that purpose. Separately, the security logs in Annex A are kept for up to 2 years after the Household closes, because they show who accessed which data if a claim or an investigation arises; they are then deleted.

14.4 The record-keeping duties that labor, social-security and tax laws place on the employer (for example, keeping contracts and pay stubs) belong to the Controller, who must download and keep its documents before they are deleted.

15. Verification

When the Controller reasonably asks, at most once a year, the Processor will give it the information needed to show it complies with this agreement, such as the current list of Sub-processors and a summary of its security measures.

16. Liability

16.1 Each party is liable for breaching its own obligations under this agreement and the Law.

16.2 If the Processor uses Processed Data for a purpose other than the one authorized, or transfers it against the Controller's instructions, it will be treated as a controller, with a controller's obligations.

16.3 To the extent the law allows, the Processor's total liability arising from this agreement will not exceed the amount paid to TSV for the Service for that Household, by the Controller or on its behalf, in the 12 months before the event that gave rise to it. This cap does not apply to breaches of clause 16.2 or of the confidentiality obligations, or to liability the law does not allow to be limited.

17. Term

This agreement remains in force for each Household while that Household holds Processed Data in Casa al Día. The confidentiality and deletion obligations survive its end.

18. Precedence

For Processed Data, this agreement prevails over the Terms of service.

19. Changes

The Processor may change this agreement to reflect changes in the law, the Service or its Sub-processors. It will give the Controller at least 30 calendar days' notice by email and in the Service, and the Controller may end the agreement before the change takes effect, with a prorated refund for the unused period. For a material change, the Service will ask the Controller to accept the new version.

20. Governing law and jurisdiction

This agreement is governed by the Law, its Regulations and the other federal laws of the United Mexican States. Disputes arising from it will be resolved by the competent courts of the place where the home in which the household workers work is located, without prejudice to the powers of the Secretaría Anticorrupción y Buen Gobierno.

21. Language

This agreement is made in Spanish with an English translation. If they differ, the Spanish text prevails.

Annex A. Description of the processing

Annex B. Security measures

• Encryption: encrypted connections (TLS); database and storage encryption by the providers; additional in-app encryption of CURP, NSS and RFC with AES-256-GCM and HMAC blind indexes for lookups, with keys kept outside the database and a scheme that allows rotating them.
• Masking and logging: identity numbers are shown masked; every decryption, every document download and every access by the Processor's staff to a Household is written to an audit log that can't be changed or deleted from the app.
• Household isolation: row-level security policies in the database, so each user reaches only the Households they belong to, with automated tests of that isolation.
• Staff access: only through server code that checks the person is on the Processor's team and logs every view; the team list can't be changed from the app.
• Documents: private storage per Household; downloads through short-lived links.
• Error diagnostics: set up not to store IP addresses, user details, request bodies or URL parameters, and to strip fields such as CURP, NSS, RFC, phone, salary and address.
• Credentials: the Processor never asks for or stores SAT passwords, the CIEC or e.firma files.
• Backups: daily backups by the database provider, kept for 7 days.
• Staff: written confidentiality obligations and least-privilege access.

Annex C. Authorized sub-processors

Stripe, Inc. processes the Controller's payments to TSV but does not process Processed Data, so it is not a sub-processor.